Microsoft GDI+ VML Heap-Based Buffer Overflow Vulnerability

Description Microsoft GDI+ is prone to a heap-based buffer-overflow vulnerability because the vector graphics link library improperly processes gradient sizes. Successfully exploiting this issue would allow an attacker to corrupt heap memory and execute arbitrary code in the context of the...

Microsoft GDI+ WMF Image File Buffer Overflow Vulnerability

Description Microsoft GDI+ is prone to a buffer-overflow vulnerability because the vector graphics linked library improperly allocates memory when parsing WMF image files. Successfully exploiting this issue would allow an attacker to corrupt memory and execute arbitrary code in the context of the...

Microsoft GDI+ GIF File Parsing Remote Code Execution Vulnerability

Description Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly parses GIF image files. An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may...

MySQL: Privilege bypass

Background MySQL is a popular multi-threaded, multi-user SQL server. Description Sergei Golubchik reported that MySQL imposes no restrictions on the specification of "DATA DIRECTORY" or "INDEX DIRECTORY" in SQL "CREATE TABLE" statements. Impact An authenticated remote attacker could create MyISAM...

Update Protection against Microsoft SQL Server Convert Function Buffer Overrun Vulnerability (MS08-040)

A buffer overflow vulnerability was reported in Microsoft SQL Server. Microsoft SQL Server is a relational database management system RDBMS. A remote attacker may exploit this vulnerability to run code on a vulnerable system...

Microsoft SQL Server Xp_sprintf 缓冲区溢出

Microsoft SQL Server 6.5Service Pack 5以前的版本中有一个存储过程xpsprintf存在一个 缓冲区溢出问题。攻击者可以使用这个存储过程使服务器崩溃，并可能在运行SQL server的系统 中获得管理员控制权限。 Microsoft SQL Server 6.5 Microsoft SQL Server 6.0 - Microsoft Windows NT 4.00 更新到更高版本的SQL Server6.5...

Microsoft SQL Server磁盘数据结构整数溢出漏洞（MS08-040）

BUGTRAQ ID: 30119 CVECAN ID: CVE-2008-0107 Microsoft SQL Server是一款流行的SQL数据库系统。 SQL Server负责解析存储备份数据的代码存在漏洞，该段代码从文件获得了代表记录大小的32位整数值用于计算所要读取到堆缓冲区的字节数。这个计算可能下溢，导致分配不充分的内存，之后的操作会触发溢出。 如果要利用这个漏洞，攻击者必须能够诱骗服务器加载特制的备份文件，可通过提交到远程文件的路径或使用SMB/WebDAV来实现。 Microsoft SQL Server 7.0 SP4 Microsoft SQL Server 2005...

Insomnia : ISVA-080709.1 - Microsoft SQL Server - Corrupt Backup File Heap Overflow

Insomnia Security Vulnerability Advisory: ISVA-080709.1 Name: Microsoft SQL Server - Corrupt Backup File Heap Overflow Released: 09 July 2008 Vendor Link: http://www.microsoft.com/sql/default.mspx Affected Products: MS SQL Server 2005, possibly previous versions Original Advisory:...

Microsoft SQL Server multiple security vulnerabilities

Buffer overflows, memorry corruptions, information leak...

iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability

iDefense Security Advisory 07.08.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 08, 2008 I. BACKGROUND SQL Server is Microsoft's database server product. It supports the restoration and inspection of backups via SQL statements. For more information see the vendor's website found at...

Microsoft Security Bulletin MS08-040 – Important Vulnerabilities in Microsoft SQL Server Could Allow Elevation of Privilege (941203)

Microsoft Security Bulletin MS08-040 – Important Vulnerabilities in Microsoft SQL Server Could Allow Elevation of Privilege 941203 Published: July 8, 2008 Version: 1.0 General Information Executive Summary This security update resolves four privately disclosed vulnerabilities. The more serious of...

Buffer overflow

Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine MSDE 2000 SP4, and 2000 Desktop Engine WMSDE allows remote authenticated users to execute arbitrary code via a crafted SQL expression...

Integer overflow

Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine MSDE 2000 SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine WMSDE; Microsoft Data Engine MSDE 1.0 SP4; and Internal Database WYukon SP2 allows remote authenticated users to execute arbitrary code...

CVE-2008-0106

Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement...

CVE-2008-0085

SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine MSDE 2000 SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine WMSDE; Microsoft Data Engine MSDE 1.0 SP4; and Internal Database WYukon SP2 does not initialize memory pages when reallocating memory, which allows database...

Buffer overflow

Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement...

CVE-2008-0086

Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine MSDE 2000 SP4, and 2000 Desktop Engine WMSDE allows remote authenticated users to execute arbitrary code via a crafted SQL expression...

CVE-2008-0107

Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine MSDE 2000 SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine WMSDE; Microsoft Data Engine MSDE 1.0 SP4; and Internal Database WYukon SP2 allows remote authenticated users to execute arbitrary code...

Design/Logic Flaw

SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine MSDE 2000 SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine WMSDE; Microsoft Data Engine MSDE 1.0 SP4; and Internal Database WYukon SP2 does not initialize memory pages when reallocating memory, which allows database...

CVE-2008-0107

CVE-2008-0107 is a memory corruption vulnerability in multiple SQL Server lineage components (SQL Server 7.0, SQL Server 2000/2005, MSDE/WYukon) triggered by a crafted on-disk file path supplied via SMB or WebDAV, leading to a heap-based buffer overflow. The flaw permits remote authenticated user...